CVE-2026-26365
HTTP Request Smuggling in Akamai CDN Edge Servers via Header Mishandling
Publication date: 2026-02-23
Last updated on: 2026-02-23
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| akamai | ghost | to 2026-02-06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-444 | The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know
Can you explain this vulnerability to me?
This vulnerability, known as Akamai Ghost, affects Akamai CDN edge servers before February 6, 2026. It mishandles the processing of custom hop-by-hop HTTP headers. Specifically, when an incoming request contains the header "Connection: Transfer-Encoding", the server might forward a request with invalid message framing depending on how Akamai processes it. This improper handling can cause the origin server to parse the request body incorrectly, which leads to HTTP request smuggling.
How can this vulnerability impact me? :
The vulnerability can lead to HTTP request smuggling, which allows an attacker to interfere with the way a web server processes sequences of HTTP requests. This can result in security issues such as bypassing security controls, gaining unauthorized access to sensitive information, or causing the origin server to misinterpret requests. The CVSS score indicates a moderate impact with low complexity and no privileges required, but it can cause integrity issues.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know